Hidden Backdoor Found in Control Web Panel Server Software, Leaving No Trace in Web Logs

Researchers at QiAnXin's XLab have found a backdoor, which they named cwpdoor, hiding in the web server that runs Control Web Panel (CWP), a free tool for managing Linux hosting servers. The backdoored server runs commands that attackers send in web requests, and those requests never show up in its access logs. It behaves like the normal program until a request arrives with a valid timestamp and signature in custom headers.

Installing the backdoor requires root access, so attackers must already control the server. The researchers captured the installer, a shell script posing as a version update, on June 29. It only handles two versions of the web server, cwpsrv 1.15.10 and 1.24.0. How attackers gain the root access is not yet known. The installer also restores the file's original dates, so common checks make it look unchanged, and the backdoor file had zero detections out of 63 on VirusTotal when the researchers checked.

On September 30, an archive containing a copy was uploaded to VirusTotal from Brazil, which the researchers say suggests "real victims already exist in the wild." No count of infected servers was given. The same archive also held Ebury, an OpenSSH backdoor and credential stealer active since at least 2009, though the researchers do not know whether the two are linked. XLab published indicators and recommended steps for infected servers.